Computer telemetry analysis

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for analyzing telemetry to detect anomalous activity. One of the methods includes accessing data describing a telemetry tree that includes a plurality of nodes and edges; querying, for each of the edges in the telemetry tree using at least one value for the edge from a number of values, historical telemetry data that quantifies an anomaly score for each value to determine whether a relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship; and performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship.

What is claimed is: 
     
       1. A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
 accessing data describing a telemetry tree that includes a plurality of nodes and edges, wherein:
 each node represents a telemetry value of a telemetry type, and one of the nodes is a root node; 
 each edge connects two of the nodes and indicates a relationship between the two of the nodes connected to the edge; and 
 each edge has a number of values based on a depth of a deepest child node of the two of the nodes to which the edge connects, and each value represents a relationship between respective spans of nodes in a path from the root node to the deepest child node to which the edge connects, each respective span of nodes being of a different length and proportional to a depth of the deepest child node from one of the root node or a descendent child node from the root node that is not the deepest child node; 
 
 querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, historical telemetry data that quantifies an anomaly score for each value to determine whether the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship; and 
 performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship. 
 
     
     
       2. The system of  claim 1 , wherein each of the values is a hash value that specifically identifies a respective span that begins from the root node or the descendent child from the root node and each respectively descends to the deepest child node. 
     
     
       3. The system of  claim 1 , wherein querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data that quantifies an anomaly score for each value comprises querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data to determine a frequency that indicates a number of times the respective value has been seen historically. 
     
     
       4. The system of  claim 1 , wherein:
 querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data that quantifies an anomaly score for each value comprises: 
 for one or more of the values for a particular edge according to an order for the values:
 querying the historical telemetry data to determine the anomaly score for the respective value; 
 determining whether the anomaly score satisfies a threshold score; and 
 in response to determining that the anomaly score satisfies the threshold score, identifying the respective relationship for the value and between the respective spans of nodes in the path from the root node to the deepest child node to which the edge connects as a potentially malicious relationship and querying the historical telemetry data for additional values for the particular edge; or 
 in response to determining that the anomaly score does not satisfy the threshold score, not querying the historical telemetry data for additional values for the particular edge; and 
 
 performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship comprises:
 determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship; and 
 performing an action using a result of the determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship. 
 
 
     
     
       5. The system of  claim 4 , wherein performing an action using a result of the determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship comprises performing an action for the relationships identified as potentially malicious relationships in response to determining that at least one of the relationships for the telemetry tree is identified as a potentially malicious relationship. 
     
     
       6. The system of  claim 1 , comprising a database that includes the historical telemetry data. 
     
     
       7. The system of  claim 1 , the operations comprising sending, for each of the values, a message to cause a database to update an anomaly score, in the historical telemetry data for the respective value, that indicates a number of times the respective value has been seen. 
     
     
       8. The system of  claim 1 , the operations comprising sending, for each of the values not included in the historical telemetry data, a message to cause a database to add the respective value with a respective anomaly score to the historical telemetry data. 
     
     
       9. A computer-implemented method, comprising:
 accessing data describing a telemetry tree that includes a plurality of nodes and edges, wherein:
 each node represents a telemetry value of a telemetry type, and one of the nodes is a root node; 
 each edge connects two of the nodes and indicates a relationship between the two of the nodes connected to the edge; and 
 each edge has a number of values based on a depth of a deepest child node of the two of the nodes to which the edge connects, and each value represents a relationship between respective spans of nodes in a path from the root node to the deepest child node to which the edge connects, each respective span of nodes being of a different length and proportional to a depth of the deepest child node from one of the root node or a descendent child node from the root node that is not the deepest child node; 
 
 querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, historical telemetry data that quantifies an anomaly score for each value to determine whether the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship; and 
 performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship. 
 
     
     
       10. The computer-implemented method of  claim 9 , wherein each of the values is a hash value that specifically identifies a respective span that begins from the root node or the descendent child from the root node and each respectively descends to the deepest child node. 
     
     
       11. The computer-implemented method of  claim 9 , wherein querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data that quantifies an anomaly score for each value comprises querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data to determine a frequency that indicates a number of times the respective value has been seen historically. 
     
     
       12. The computer-implemented method of  claim 9 , wherein:
 querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, the historical telemetry data that quantifies an anomaly score for each value comprises: 
 for one or more of the values for a particular edge according to an order for the values:
 querying the historical telemetry data to determine the anomaly score for the respective value; 
 determining whether the anomaly score satisfies a threshold score; and 
 in response to determining that the anomaly score satisfies the threshold score, identifying the respective relationship for the value and between the respective spans of nodes in the path from the root node to the deepest child node to which the edge connects as a potentially malicious relationship and querying the historical telemetry data for additional values for the particular edge; or 
 in response to determining that the anomaly score does not satisfy the threshold score, not querying the historical telemetry data for additional values for the particular edge; and 
 
 performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship comprises:
 determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship; and 
 performing an action using a result of the determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship. 
 
 
     
     
       13. The computer-implemented method of  claim 12 , wherein performing an action using a result of the determining whether any of the relationships for the telemetry tree are identified as a potentially malicious relationship comprises performing an action for the relationships identified as potentially malicious relationships in response to determining that at least one of the relationships for the telemetry tree is identified as a potentially malicious relationship. 
     
     
       14. The computer-implemented method of  claim 9 , the operations comprising sending, for each of the values, a message to cause a database to update an anomaly score, in the historical telemetry data for the respective value, that indicates a number of times the respective value has been seen. 
     
     
       15. The computer-implemented method of  claim 9 , the operations comprising sending, for each of the values not included in the historical telemetry data, a message to cause a database to add the respective value with a respective anomaly score to the historical telemetry data. 
     
     
       16. A non-transitory computer storage device on which are stored instructions that are operable, when executed by a one or more computers, cause the one or more computers to perform operations comprising:
 accessing data describing a telemetry tree that includes a plurality of nodes and edges, wherein: 
 each node represents a telemetry value of a telemetry type, and one of the nodes is a root node; 
 each edge connects two of the nodes and indicates a relationship between the two of the nodes connected to the edge; and 
 each edge has a number of values based on a depth of a deepest child node of the two of the nodes to which the edge connects, and each value represents a relationship between respective spans of nodes in a path from the root node to the deepest child node to which the edge connects, each respective span of nodes being of a different length and proportional to a depth of the deepest child node from one of the root node or a descendent child node from the root node that is not the deepest child node; 
 querying, for each of the edges in the telemetry tree using at least one value for the edge from the number of values, historical telemetry data that quantifies an anomaly score for each value to determine whether the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship; and 
 performing an action using a result of the querying of the historical telemetry data that indicates whether one of the anomaly scores indicates that the relationship indicated by the edge in the telemetry tree represents a potentially malicious relationship.